BattleChain Confidence Pools
Cyfrin
FoundrySolidityLayer 2
7.25 ETH
View all submissions
Previous Next
Submission Details
Severity: low
Valid

sweepUnclaimedBonus during the moderator's re-flag window permanently diverts a good-faith attacker's bonus bounty to recoveryAddress

Author Revealed upon completion

Root + Impact

Description

A pool that resolves CORRUPTED is meant to pay the entire pool (staked principal + contributed bonus) to the moderator-named good-faith whitehat attacker (docs/DESIGN.md §12). The moderator may correct an outcome (e.g. SURVIVED → CORRUPTED) at any time before the first value-moving claim — and sweepUnclaimedBonus deliberately does not latch claimsStarted, so that correction window stays open after a sweep.

When a pool resolves without an observed risk window (riskWindowStart == 0 — DESIGN.md §5's "no-risk-window CORRUPTED race"), sweepUnclaimedBonus reserves only the staked principal and lets the entire contributed bonus be swept to the sponsor-controlled recoveryAddress. A single permissionless sweep, timed between an honest out-of-scope flagOutcome(SURVIVED) and its designed-for correction to flagOutcome(CORRUPTED), permanently removes the bonus from the whitehat's bounty: the re-flag re-reads the now-zeroed live totalBonus into the snapshot.

// src/ConfidencePool.sol :: sweepUnclaimedBonus() (~L483)
uint256 reserved;
if (totalEligibleStake != 0) {
reserved = totalEligibleStake;
@> if (riskWindowStart != 0) { // bonus reserved ONLY when a risk window existed
reserved += snapshotTotalBonus - claimedBonus;
}
}
// => with riskWindowStart == 0, the whole totalBonus is swept to recoveryAddress,
// and claimsStarted is intentionally NOT set (L503), leaving the re-flag window open.
​
// src/ConfidencePool.sol :: flagOutcome() (re-flag allowed while !claimsStarted, L327)
@> snapshotTotalBonus = totalBonus; // re-reads the now-zeroed bonus (L358)
bountyEntitlement = willBeGoodFaithCorrupted ? snapshotTotalStaked + snapshotTotalBonus : 0; // L362

Risk

Likelihood:

  • Applies whenever the registry reaches a terminal CORRUPTED state without any pool entrypoint observing an active-risk state first (a fast ATTACK_REQUESTED → CORRUPTED transition), leaving riskWindowStart == 0 — a path the protocol's own DESIGN.md §5 documents as reachable.

  • The moderator makes the documented out-of-scope SURVIVED call and later corrects it to CORRUPTED; the sweepUnclaimedBonus() trigger is permissionless, so any third party — or the sponsor who owns recoveryAddress — front-runs the correction.

Impact:

  • Permanent, unrecoverable diversion of up to 100% of the pool's contributed bonus to recoveryAddress instead of the named whitehat.

  • Breaks the DESIGN.md §12 guarantee that a CORRUPTED resolution makes the entire pool the attacker's bounty; the whitehat is shorted to principal-only.

Proof of Concept

Two Foundry tests (extending the repo's BaseConfidencePoolTest) share identical preconditions; the only difference is the inserted SURVIVED misflag plus one permissionless sweepUnclaimedBonus(). control yields the intended stake + bonus; exploit yields stake only, with the bonus stranded at recoveryAddress.

uint256 internal constant STAKE = 100 * ONE;
uint256 internal constant BONUS = 50 * ONE;
​
// Intended behavior: attacker receives the WHOLE pool (DESIGN.md §12).
function test_control_attackerGetsWholePool() public {
_stake(alice, STAKE);
_contributeBonus(bob, BONUS);
attackRegistry.setAgreementState(IAttackRegistry.ContractState.CORRUPTED);
​
vm.prank(moderator);
pool.flagOutcome(PoolStates.Outcome.CORRUPTED, true, attacker);
assertEq(pool.riskWindowStart(), 0);
​
vm.prank(attacker);
pool.claimAttackerBounty();
assertEq(token.balanceOf(attacker), STAKE + BONUS);
assertEq(token.balanceOf(recovery), 0);
}
​
// Exploit: a permissionless sweep inside the re-flag window strips the bonus from the bounty.
function test_exploit_bonusDivertedFromAttacker() public {
_stake(alice, STAKE);
_contributeBonus(bob, BONUS);
attackRegistry.setAgreementState(IAttackRegistry.ContractState.CORRUPTED);
assertEq(pool.riskWindowStart(), 0);
​
vm.prank(moderator); // 1) honest out-of-scope misflag
pool.flagOutcome(PoolStates.Outcome.SURVIVED, false, address(0));
​
vm.prank(makeAddr("griefer")); // 2) permissionless sweep
pool.sweepUnclaimedBonus();
assertEq(token.balanceOf(recovery), BONUS);
assertEq(pool.totalBonus(), 0);
​
vm.prank(moderator); // 3) designed-for correction
pool.flagOutcome(PoolStates.Outcome.CORRUPTED, true, attacker);
assertEq(pool.bountyEntitlement(), STAKE); // bounty shrunk to stake-only
​
vm.prank(attacker); // 4) whitehat shorted
pool.claimAttackerBounty();
assertEq(token.balanceOf(attacker), STAKE);
assertEq(token.balanceOf(recovery), BONUS); // bonus lost to recovery
}

Concrete outcome: the named whitehat receives 100e18 (stake only) instead of the promised 150e18 (stake + bonus) — 50e18, i.e. 100% of the contributed bonus, is permanently diverted to recoveryAddress.

Result (Foundry 1.7.1, solc 0.8.26, run against the contest commit in an isolated container):

[PASS] test_control_attackerGetsWholePool() (gas: 578313)
[PASS] test_exploit_bonusDivertedFromAttacker() (gas: 591939)
Suite result: ok. 2 passed; 0 failed

Recommended Mitigation

Do not let the bonus leave the pool while the outcome can still be corrected to CORRUPTED (i.e. before claimsStarted):

function sweepUnclaimedBonus() external nonReentrant {
if (outcome != PoolStates.Outcome.SURVIVED && outcome != PoolStates.Outcome.EXPIRED) {
revert OutcomeNotEligibleForSweep();
}
+ // The moderator's SURVIVED->CORRUPTED correction window is open until the first
+ // value-moving claim; sweeping the bonus now would strip a later CORRUPTED bounty.
+ if (!claimsStarted) revert OutcomeNotFinal();

Alternatively, reserve snapshotTotalBonus - claimedBonus regardless of riskWindowStart whenever !claimsStarted, and on a SURVIVED → CORRUPTED re-flag reconstruct the bounty from the resolution-time totals rather than the post-sweep live totalBonus.

Updates

Lead Judging Commences

inallhonesty Lead Judge 2 days ago
Submission Judgement Published
Validated
Assigned finding tags:

sweepUnclaimedBonus() omits claimsStarted latch, letting a moderator re-flag re-snapshot a drained totalBonus and short the CORRUPTED bounty

Impact – Medium Up to the entire bonus pool can be routed to the wrong party for good, with no on-chain way to unwind it, and in a stakerless pool the effect is total since bountyEntitlement computes to zero and claimAttackerBounty reverts outright. This impact is definitely not High: the pool stays solvent throughout with no principal ever at risk, and the money ends up at the sponsor's own recoveryAddress, which in most pools means a sponsor recovering a bonus they funded themselves. The whitehat's claim on that bonus also only exists because the moderator changed their mind after the fact. Likelihood – Low Four separate things have to coincide: nobody touches the pool for the whole active-risk window (or there are no stakers to begin with), the moderator flags SURVIVED and later reverses to CORRUPTED, that reversal is good-faith with a named attacker, and a sweep lands between the two flags. The first cuts against staker self-interest, since skipping the poke costs them their entire bonus share, and the second asks the moderator to overturn a scope judgement, which is a bigger deal than the typo fix DESIGN.md #4 offers the window for. The sweep itself I'd treat as near-certain once the rest holds, given it's permissionless and the sponsor has an obvious reason to make the call, but assembling the first three in one pool lifecycle is where this stays rare.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!